AgentsAugust 21, 2026via InfoQ AI/ML
Presentation: Enchant Your AI and APIs with eBPF Magic 🪄
Why it matters
eBPF enables transparent, infrastructure-level control of AI agent behavior in production (prompt filtering, model swapping, token limits, syscall restrictions) without touching application code—a critical security pattern for autonomous systems at scale.
Key signals
- eBPF kernel-level socket hooks intercept AI API traffic in Kubernetes
- Transparent prompt filtering and model swapping without source code modification
- Token limits and syscall restrictions enforced at kernel level
- No container restart required for policy changes
- Addresses unowned (AI-generated) code execution risk in production
- Demonstration of agent security infrastructure pattern
- eBPF socket hooks enable transparent AI API traffic interception in Kubernetes
- Kernel-level controls: prompt filtering, model swapping, token limits, syscall restrictions
- No application source code modification required
- No container restart required
- Focus on securing unowned/third-party AI-generated code in production
- Agent governance without invasive instrumentation
The hook
Kernel-level socket hooks just became your AI agent firewall—no code changes, no restarts.
Dan Finneran discusses the risks of unowned AI-generated code in production and demonstrates how eBPF can intercept and control AI API traffic in Kubernetes. He explains how kernel-level socket hooks enable transparent prompt filtering, model swapping, token limits, and syscall restrictions to secur…